Skip to content

[JSC][Temporal] Fix crash in Temporal.PlainMonthDay.from with very large string input#66887

Open
hyjorc1 wants to merge 1 commit into
WebKit:mainfrom
hyjorc1:eng/JSC-Temporal-Fix-crash-in-Temporal-PlainMonthDay-from-with-very-large-string-input
Open

[JSC][Temporal] Fix crash in Temporal.PlainMonthDay.from with very large string input#66887
hyjorc1 wants to merge 1 commit into
WebKit:mainfrom
hyjorc1:eng/JSC-Temporal-Fix-crash-in-Temporal-PlainMonthDay-from-with-very-large-string-input

Conversation

@hyjorc1

@hyjorc1 hyjorc1 commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

e805398

[JSC][Temporal] Fix crash in Temporal.PlainMonthDay.from with very large string input
https://bugs.webkit.org/show_bug.cgi?id=316805
rdar://179110736

Reviewed by NOBODY (OOPS!).

fromMonthDayString used makeString to include the user-supplied string
in the RangeError message. makeString calls WTFCrash on allocation
failure, so passing a very large string (e.g. ~2 GB) caused a crash
instead of a clean RangeError.

Fix by using tryMakeString with a static fallback message, matching the
pattern already used in fromYearMonthString.

Test: JSTests/stress/temporal-plainmonthday-from-large-string.js

e805398

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows Apple Internal
✅ 🧪 style ✅ 🛠 ios loading 🛠 mac ✅ 🛠 wpe ⏳ 🛠 win ⏳ 🛠 ios-apple
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ⏳ 🧪 wpe-wk2 ⏳ 🧪 win-tests ⏳ 🛠 mac-apple
✅ 🧪 webkitperl ⏳ 🧪 ios-wk2 loading 🧪 api-mac ⏳ 🧪 api-wpe ⏳ 🛠 vision-apple
⏳ 🧪 ios-wk2-wpt ⏳ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
⏳ 🛠 🧪 jsc-x86-64 ⏳ 🧪 api-ios loading 🧪 mac-wk1 ✅ 🛠 gtk
⏳ 🛠 🧪 jsc-debug-arm64 ⏳ 🛠 ios-safer-cpp loading 🧪 mac-wk2 ⏳ 🧪 gtk-wk2
✅ 🛠 vision ⏳ 🧪 mac-AS-debug-wk2 ⏳ 🧪 api-gtk
✅ 🛠 vision-sim loading 🧪 mac-wk2-stress ✅ 🛠 playstation
✅ 🧪 vision-wk2 loading 🧪 mac-intel-wk2 ✅ 🛠 jsc-armv7
✅ 🛠 tv ⏳ 🛠 mac-safer-cpp loading 🧪 jsc-armv7-tests
✅ 🛠 tv-sim loading 🧪 mac-site-isolation
✅ 🛠 watch
✅ 🛠 watch-sim

@hyjorc1 hyjorc1 requested a review from a team as a code owner June 10, 2026 17:38
@hyjorc1 hyjorc1 self-assigned this Jun 10, 2026
@hyjorc1 hyjorc1 added the New Bugs Unclassified bugs are placed in this component until the correct component can be determined. label Jun 10, 2026

@Achierius Achierius left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me

…rge string input

https://bugs.webkit.org/show_bug.cgi?id=316805
rdar://179110736

Reviewed by NOBODY (OOPS!).

fromMonthDayString used makeString to include the user-supplied string
in the RangeError message. makeString calls WTFCrash on allocation
failure, so passing a very large string (e.g. ~2 GB) caused a crash
instead of a clean RangeError.

Fix by using tryMakeString with a static fallback message, matching the
pattern already used in fromYearMonthString.

Test: JSTests/stress/temporal-plainmonthday-from-large-string.js
@hyjorc1 hyjorc1 force-pushed the eng/JSC-Temporal-Fix-crash-in-Temporal-PlainMonthDay-from-with-very-large-string-input branch from 779631c to e805398 Compare June 10, 2026 19:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

New Bugs Unclassified bugs are placed in this component until the correct component can be determined.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants